Written in Visual Basic, Server is compressed with UPX

Released in July 2004

Server:
dropped files:
c:\WINDOWS\DIjpg.dll       Size: 413,756 bytes 
c:\WINDOWS\MSWINSCK.OCX    Size: 108,336 bytes 
c:\WINDOWS\win32api.exe    Size: 53,248 bytes 

port: 7744, 5454 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "win32api.exe"
data: C:\windows\win32api.exe 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "win32api.exe"
data: C:\windows\win32api.exe 



tested on Windows XP
May 30, 2005